[lkml]   [2004]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: TCP-RST Vulnerability - Doubt
    In article <>,
    David S. Miller <> wrote:
    >RFC2385 MD5 hashing support is going in soon, and for the application where
    >the vulnerability actually matters (BGP sessions between backbone routers)
    >MD5 clears that problem right up and they're all using MD5 protection already

    MD5 protection on BGP sessions isn't very common yet. MD5 uses CPU,
    and routers don't usually have much of that. Which means that now an
    MD5 CPU attack is possible instead of a TCP RST attack.

    The "TTL hack" solution is safer. Make sure sender uses a TTL
    of 255, on the receiver discard all packets with a TTL < 255.
    You can use iptables to implement that on a Linux box.


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:04    [W:0.031 / U:31.820 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site